make verify: add the Lens pass container (both apps, cheapest first)

Root verify runs check first, then a per-app verify in each Makefile: sensor
slots hooked to VERIFY_SENSORS (empty today, so nothing is claimed that is not
run) and then that app's suite. Measured: 9.9s wall, app 178 + blogex 156 tests.

Makefile

@@ -2,7 +2,7 @@
 
 MISE_BIN ?= mise
 
-.PHONY: check precommit deps compile test test-elisp format
+.PHONY: check precommit deps compile test test-elisp format verify
 
 # Cheap static gate over both apps, cheapest first. No database, no coverage:
 # this is the loop you run freely while working and before every commit.
@@ -17,6 +17,16 @@ check:
 # Precommit target for CI/pre-commit hooks
 precommit: check
 
+# The Lens pass: everything `check` does, plus the heavy sensors and both test
+# suites, cheapest first. `.githooks/pre-push` runs this before every push (see
+# `make hooks`); run it yourself before handing off. Bypass deliberately with
+# `git push --no-verify`.
+verify: check
+	@echo "==> verify: app"
+	@$(MAKE) -C app MISE_BIN=$(MISE_BIN) verify
+	@echo "==> verify: blogex"
+	@$(MAKE) -C blogex MISE_BIN=$(MISE_BIN) verify
+
 # Sync dependencies
 deps:
 	@make -C app deps

app/Makefile

@@ -3,7 +3,7 @@
 MISE_BIN ?= mise
 MISE_EXEC = $(MISE_BIN) exec --
 
-.PHONY: check precommit deps compile test format credo
+.PHONY: check precommit deps compile test format credo verify
 
 # Run all static analysis checks (no database required)
 check: credo format
@@ -95,3 +95,26 @@ playwright-full: playwright-docker-start
 # Run Credo static analysis
 credo:
 	$(MISE_EXEC) mix credo --strict
+
+# =============================================================================
+# Lens pass (heavy checks; root `make verify` runs this before every push)
+# =============================================================================
+#
+# Sensor slots, cheapest first. Credo is cheap enough that it lives in
+# `check`, not here. Add a sensor as its yak lands, both as a target and to
+# VERIFY_SENSORS — that variable is the single source of truth for what this
+# target reports as wired.
+#   - sobelow    (yak: sobelow in the Lens pass)
+#   - coverage   (yak: coverage floors + framework-glue exclusions policy)
+#   - crap       (yak: CRAP scores with ex_crap (both apps))
+#   - mutation   (yak: mutation testing with muex — a sensor, not a gate)
+#
+# Runtime note: the coverage yak should make this export coverage from a single
+# suite run (test --cover --export-coverage) that CRAP reuses, instead of
+# running the suite twice.
+VERIFY_SENSORS :=
+
+verify:
+	@echo "==> verify(app): sensors [$(if $(VERIFY_SENSORS),$(VERIFY_SENSORS),none wired yet)]"
+	@for sensor in $(VERIFY_SENSORS); do $(MAKE) $$sensor || exit 1; done
+	@$(MAKE) test

blogex/Makefile

@@ -3,7 +3,7 @@
 MISE_BIN ?= mise
 MISE_EXEC = $(MISE_BIN) exec --
 
-.PHONY: check precommit deps compile test format
+.PHONY: check precommit deps compile test format verify
 
 # Cheap static gate for this library (no database, no coverage). Runs from the
 # root `make check`, which loops app then blogex.
@@ -33,3 +33,20 @@ test: deps
 # Format code
 format:
 	$(MISE_EXEC) mix format
+
+# =============================================================================
+# Lens pass (heavy checks; root `make verify` runs this before every push)
+# =============================================================================
+#
+# Sensor slots, cheapest first. Add a sensor as its yak lands, both as a target
+# and to VERIFY_SENSORS — that variable is the single source of truth for what
+# this target reports as wired.
+#   - coverage   (yak: coverage floors + framework-glue exclusions policy)
+#   - crap       (yak: CRAP scores with ex_crap (both apps))
+#   - mutation   (yak: mutation testing with muex — a sensor, not a gate)
+VERIFY_SENSORS :=
+
+verify:
+	@echo "==> verify(blogex): sensors [$(if $(VERIFY_SENSORS),$(VERIFY_SENSORS),none wired yet)]"
+	@for sensor in $(VERIFY_SENSORS); do $(MAKE) $$sensor || exit 1; done
+	@$(MAKE) test